"Preventing Loss of Personal Data on a Mobile Network", Oleksii Lukin
•Download as PPTX, PDF•
0 likes•353 views
1. The document discusses preventing loss of personal data on a mobile network by addressing technical attacks and risks. It defines personal data as customer information like names, locations, call records, and payment details that are processed and stored on network and IT systems. 2. Attacks on the mobile network, signaling infrastructure, radio access network, internet, internal networks and business support systems are outlined. Risks include hacking, fraud, and unauthorized access to or corruption of customer data. Controls proposed include firewalls, encryption, access controls, monitoring and security best practices. 3. Managing risks to personal data requires ongoing assessment, testing, monitoring and incident response as technologies and attacks evolve over time. Security must be applied across
Report
Share
More Related Content
What's hot
What's hot (20)
Similar to "Preventing Loss of Personal Data on a Mobile Network", Oleksii Lukin
Similar to "Preventing Loss of Personal Data on a Mobile Network", Oleksii Lukin (20)
More from HackIT Ukraine
More from HackIT Ukraine (20)
Recently uploaded
Recently uploaded (20)
"Preventing Loss of Personal Data on a Mobile Network", Oleksii Lukin
- 1. Preventing loss of personal data on a Mobile Network 23.09.2017 / Oleksii Lukin / Head Of Information Security SubDepartment Public
- 2. • Lukin Oleksii – Head od Information Security SubDepartment • Scope – Presentation focused on technical attacks on a Mobile network and its supporting infrastructure – Does not looking specifically are employee internal risks or social engineering attacks both of which constitute significant risks for any organisation Introduction 2
- 3. 1. Definition of personal data in a mobile network 2. Mobile Network attacks & controls 3. BSS & Corporate Network attacks & controls 4. Key Message Agenda
- 4. Definition of personal data in a mobile network 4 Mobile Network & Corporate systems Generated Business Process Generated Processed and stored on Network & IT Systems • Customer • Location data (cell site, country) • Usage records created for billing • Call, SMS, MMS details (not content) • Data usage • Corporate • Email • Web browsing • Customer • Account type (e.g. pre or post- paid/residential or business) • Name of customer • Billing Address • Payment details • Employee • Name • Contact details • Salary Dynamic/Event Static
- 5. Mobile Network Attacks - External 5 Mobile Network GRX Network (Used for roaming data traffic) Internet (Used for data traffic) SS7/Diameter (Used for roaming & interconnect signalling) Radio Access Network • All area of a Mobile Network are under constant academic study for new vulnerabilities that impact customer privacy
- 6. Mobile Network Attacks - External Signalling • SS7 (2G-3G) – Know attacks on SS7 signalling network – Abuse MAP signalling protocol – Take advantage of external links to roaming partners – Used for location tracking and call/SMS interception – DoS on individual customer or network • Diameter (4G) – New protocol replacing SS7 in LTE networks – Attacks similar to SS7 – Difficult to track origination as uses hop-by hop • GRX traffic – GTP protocol hacking – DNS attacks – Remote Call control – DoS • SS7 – Signalling firewall blocking all unauthorised MAP signalling traffic – GSMA standardised controls – Monitoring for abuse (SIEM) • Diameter – Signalling firewall – GSMA standardised controls – Implementation of Diameter Routing Agent/Diameter Edge Agent – IPsec on external connection with IPX provider – Monitoring for abuse (SIEM) • GRX (called IPX in 4G) – GTP protocol aware firewall border firewall – DNS hardening – White lists of valid roaming partners – Uses of GRX/IPX hub provider – Monitoring for abuse (SIEM) 6 Risks Controls
- 7. Mobile Network Attacks – Radio Access Network • 2G/2.5G – Risks well know – Man in the middle (IMSI Catcher) for accurate location and call/SMS interception – Weaknesses in GPRS protocol – Weakness in over the air encryption keys • 3G – Limited location attacks • 4G – Standard network IP backhaul network open to eavesdropping of customer traffic • 2G/2.5G – Implementation of latest GSMA encryption algorithms – Configuration of authentication and over the air encryption parameters – Customer applications that can detect MITM attacks • 3G – Standard has improved encryption and network mutual authentication – Configuration of authentication and over the air encryption • 4G – Use of IPSec to protect backhaul network – Standard has improved encryption and over the air authentication 7 Risks Controls
- 8. Mobile Network Attacks – Internet • Same standardised Internet access for all radio technologies e.g. 2.5G/3G/4G • DoS – Customer – Network elements • DNS – DoS – Poisoning • Products & Services (web) – DoS, hacking & scripting on – Customer Portal – Self service – Products (e.g. Child location tracking) • Border firewall • DoS Protection • NAT’ng • Hardened DNS • Web services – WAF – Code review & Testing – Internal vulnerability Scanning • External vulnerability scanning • Monitoring for abuse (SIEM) 8 Risks Controls
- 9. Mobile Network Attacks – Internal • Network & Service Delivery Elements – Unauthorised access to customer information – Ability to change customer service profile • Note: Each network element or service delivery platform has differing risks and may or may not contain meaningful customer information – e.g. GSM uses a temporary identity (T-IMSI) on some network elements to hide the customer true IMSI • Internal firewall between domains • Strong access control policy • Security Patch management • Security testing • Internal vulnerability scanning • Monitoring for abuse (SIEM) 9 Risks Controls
- 10. Remote Vendor Support • Mobile network generated event data is stored and processed in the BSS environment • There is segmentation between corporate users and BSS platforms Business Support System (BSS) & Corporate Network 10 BSS & Corporate Internet (email, Corporate Internet) Mobile Network
- 11. BSS & Corporate Network Attacks – External • Corporate Email – Phishing – Malware & Virus – SPAM – DoS • Corporate Internet – DoS – Malware & Virus – Hacking – Fake sites – Internal DNS • Unprotected vendor access – Unauthorised access to Network and IT systems • Border firewall – DoS Protection • Hardened DNS • External vulnerability scanning • Anti-virus and Malware protection • Security Patching • Data Loss Protection – Protects against internal fraud/abuse of customer information • VPN, VDI, strong authentication for vendor access • Monitoring for abuse (SIEM) 11 Risks Controls
- 12. BSS & Corporate Network Attacks - Internal • Billing & Charging Platforms – Loss or corruption of charging event data – Unauthorised access to customer information • Customer Care – Unauthorised access to customer information – Unauthorised changes (fraud) • Data Warehouse & Reporting Systems – Unauthorised access to customer information • HR Systems – Access to personal employee information • Network Support Systems – Ability to monitor customer activity – Unauthorised changes to customer’s service • Border firewall – DoS Protection • Hardened DNS • External vulnerability scanning • Anti-virus and Malware protection • Security Patching • Data Loss Protection – Protects against internal fraud/abuse of customer & corporate information • Strong access control policy • VPN, VDI & strong authentication for vendor access • Monitoring for abuse (SIEM) 12 Risks Controls
- 13. • Personal data is created and stored both in the Mobile , BSS and Corporate networks • Some areas of risk are harder to manage as they are reliant on – Technology standardisation – People • Security should always be applied in layers with good basic principles • Initial security assessment with continual testing and review • 24x7 monitoring using a SOC (SIEM) • Effective incident response process Key Message 13 Managing the risks to personal data is a continuous process as technology and the skills of the attacker evolve